Disable SNMP v1 or SNMP v2c While Other Versions Remain Enabled

Available Languages

Download Options

PDF (7.6 KB)
View with Adobe Reader on a variety of devices

Updated:March 2, 2012

Document ID:113469

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Prerequisites

Requirements

Components Used

Conventions

Procedure

Related Information

Introduction

This document describes how to disable SNMP version 1 or version 2c while other versions are enabled.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

This document is valid for any Cisco IOS^® device that runs 12.0(3)T or higher. The procedure in this document was verified on a Cisco 2821 that runs 15.2(2)T.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

Refer to the Cisco Technical Tips Conventions for information on document conventions.

Procedure

Given the Internet security issues with Simple Network Management Protocol (SNMP) versions 1 and 2c, users often choose to disable community-based SNMP in favor of the more secure SNMP version 3 User Security Model (USM). However, sometimes it is desirable to leave community-based SNMP enabled for legacy applications.

In order to make sure that applications can get the most accurate data, as well as benefit from the more scalable SNMP GETBULK message type, you can disable SNMPv1 while SNMPv2c remains enabled.

Every time an SNMP community string is configured, the device internally configures two SNMP groups for that community: one group for v1 and another group for v2c. In order to disable one of the protocol versions, that group must be deleted.

The command to delete a group is no snmp-server group <community> v1.

For example, consider this community is configured:

Router(config)#snmp-server community public ro

The device creates these groups:

groupname: public                          security model:v1
readview : v1default                       writeview: <no writeview specified> 
notifyview: <no notifyview specified>
row status: active

groupname: public                          security model:v2c
readview : v1default                       writeview: <no writeview specified>

When the command no snmp-server group public v1 is configured, the public group for SNMPv1 is removed, and SNMPv1 requests to the device are ignored.

This procedure must be performed for all community strings configured on the device.